Hands-On Lab: Configuring OSPF Authentication

Lab Objective

Configure MD5 authentication on an OSPF-enabled interface between two routers, verify the neighbor relationship forms successfully when keys match, then introduce a key mismatch and observe the resulting adjacency failure.

Lab Purpose

Without authentication, any device that can send properly formatted OSPF hello packets on a shared segment can potentially form an unauthorized neighbor relationship and inject false routing information. MD5 authentication ensures only routers sharing a common secret key can become neighbors.

Lab Topology

R1 ---- Gi0/0 ------------------ Gi0/0 ---- R2
     192.168.110.1/24         192.168.110.2/24

OSPF process 1, area 0, already forming a
healthy adjacency between R1 and R2

Task 1: Verify the Current Healthy Adjacency

Confirm R1 and R2 show a FULL neighbor relationship before adding authentication.

Task 2: Configure MD5 Authentication on R1

Enable OSPF MD5 authentication on R1's interface with a specific key.

Task 3: Configure Matching MD5 Authentication on R2

Enable the identical key on R2's corresponding interface.

Task 4: Verify the Adjacency Remains FULL

Confirm the neighbor relationship is unaffected, since both keys match.

Task 5: Introduce a Key Mismatch

Change R2's key to a different value and observe the resulting adjacency failure.

Task 6: Correct the Mismatch

Restore matching keys and confirm the adjacency recovers.

Solution and Verification

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Address
2.2.2.2          1     FULL/BDR        192.168.110.2

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip ospf message-digest-key 1 md5 OspfKey2026
R1(config-if)# ip ospf authentication message-digest

R2(config)# interface gigabitethernet0/0
R2(config-if)# ip ospf message-digest-key 1 md5 OspfKey2026
R2(config-if)# ip ospf authentication message-digest

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Address
2.2.2.2          1     FULL/BDR        192.168.110.2
-- Adjacency remains FULL, since both sides
-- now share the identical key

R2(config)# interface gigabitethernet0/0
R2(config-if)# ip ospf message-digest-key 1 md5 DifferentKey999

R1# show ip ospf neighbor

-- (Neighbor entry eventually disappears
--  entirely once the dead timer expires)

R1# debug ip ospf adj

*OSPF: Rcv pkt from 192.168.110.2, Mismatch
Authentication Key - Message Digest Key ID 1

R2(config)# interface gigabitethernet0/0
R2(config-if)# ip ospf message-digest-key 1 md5 OspfKey2026

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Address
2.2.2.2          1     FULL/BDR        192.168.110.2
-- Adjacency recovers once the keys match again

Key Takeaway

An MD5 key mismatch produces a distinct debug message explicitly naming the authentication failure, unlike the generic "up, line protocol down" symptom seen with clocking or encapsulation mismatches discussed earlier in this series — this specific error message immediately points toward checking authentication configuration on both sides rather than the broader troubleshooting checklist a vaguer symptom would require.